HOOKCHAIN

Summary from the TLDR InfoSec newsletter

hookchain aims to provide a new perspective on EDR Evasion. Through a precise combination of IAT Hooking techniques, dynamic SSN resolution, and indirect system calls, hookchain redirects the execution flow of Windows subsystems in a way that remains invisible to the vigilant eyes of EDRs that only act on Ntdll.dll without requiring changes to the source code of the applications and malware involved.